vade-cli 0.1.0

A command-line tool to deploy applications on Linux servers
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82

# Initial server setup: create an operator user with passwordless sudo and SSH access, harden root
# login, enable unattended upgrades, and set up a ufw firewall. Meant to be applied as root.
import os
from io import StringIO

from pyinfra.operations import server, files, apt
from pyinfra.api.exceptions import DeployError

operator_username = os.environ.get("VADE_USERNAME") or "operator"

public_key_path = os.environ.get("VADE_PUBLIC_KEY_PATH")
if not public_key_path:
    raise DeployError("VADE_PUBLIC_KEY_PATH environment variable is missing!")
public_key = open(public_key_path).read().strip()

###
# Setup operator user
###

files.put(
    name="Setup passwordless-sudo",
    src=StringIO("%sudo ALL=(ALL) NOPASSWD: ALL\n"),
    dest="/etc/sudoers.d/vade",
    user="root",
    group="root",
    mode="440",
)

server.shell(
    name="Validate the sudoers drop-in",
    commands=["visudo -cf /etc/sudoers.d/vade"],
)

server.user(
    name="Create a regular user with sudo privileges and SSH access",
    user=operator_username,
    shell="/bin/bash",
    groups=["sudo"],
    append=True,
    create_home=True,
    public_keys=[public_key],
)

files.line(
    name="Disable password authentication for root",
    path="/etc/ssh/sshd_config",
    line=r"^#?PermitRootLogin",
    replace="PermitRootLogin prohibit-password",
)

###
# Setup unattended upgrades
###

apt.packages(
    name="Set up unattended upgrades",
    packages=["unattended-upgrades"],
    latest=True,
    update=True,
)

# Setup ufw

# note: as of this writing, pyinfra core has no ufw operation, so we use the CLI (idempotency is )

apt.packages(
    name="Install ufw",
    packages=["ufw"],
    latest=True,
    update=True,
)

server.shell(
    name="Configure ufw (allow SSH/HTTP/HTTPS, deny everything else)",
    commands=[
        "ufw allow OpenSSH",
        "ufw allow 80/tcp",
        "ufw allow 443/tcp",
        "ufw default deny",
        "ufw --force enable",
    ],
)